CAPEC-690
Metadata Spoofing
An adversary alters the metadata of a resource (e.g., file, directory, repository, etc.) to present a malicious resource as legitimate/credible.
On this page
One approach to this attack entails the adversary altering a maliciously modified resource's metadata in order to hide their malicious activity. Another approach involves altering the metadata of an adversary-created resource to make the source appear more credible. Adversaries may spoof a variety of metadata across a number of resources, such as the following:
- Authors of Version Control System (VCS) repository commits
- Open source package statistics
- File attributes, such as when a file was last update
The ultimate goal of a Metadata Spoofing attack is to trick victims into believing the malicious resource being provided originates from a reputable source. However, the victim instead leverages the malicious resource, which could result in a number of negative technical impacts.
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-690: Metadata Spoofing: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/690.html and https://cve.bz/cve/capec/690?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
Identification of a resource whose metadata is to be spoofed
Skills required
- Medium skill
Ability to spoof a variety of metadata to convince victims the source is trusted
Consequences
| Impact | Affects | Note |
|---|---|---|
| Modify Data | Integrity | |
| Hide Activities | Accountability | |
| Execute Unauthorized Commands | Access Control, Authorization |
Mitigations
Validate metadata of resources such as authors, timestamps, and statistics.
Confirm the pedigree of open source packages and ensure the code being downloaded does not originate from another source.
Even if the metadata is properly checked and a user believes it to be legitimate, there may still be a chance that they've been duped. Therefore, leverage automated testing techniques to determine where malicious areas of the code may exist.
Related attack patterns
- More specific patterns
- CAPEC-691 Spoof Open-Source Software Metadata
MITRE's words, unchanged: CAPEC-690 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.